What causes "Unable to verify alias '${alias}' in trust store '${name}'" in quarkusio/quarkus?

Check the wrapped KeyStoreException cause for the root problem

quarkusio/quarkus · error · java.lang.IllegalStateException

Unable to verify alias '${alias}' in trust store '${name}'

Error message

Unable to verify alias '${alias}' in trust store '${name}'

What it means

During trust store alias verification, KeyStore.getCertificate(alias) threw KeyStoreException. The registry wraps it with the trust store name and alias. This signals the trust store itself is in a broken/unsupported state, not that the alias is missing.

Source

Thrown at extensions/tls-registry/runtime/src/main/java/io/quarkus/tls/runtime/keystores/OtherKeyStores.java:176

            } catch (KeyStoreException | NoSuchAlgorithmException e) {
                throw new IllegalStateException("Unable to verify alias '" + alias + "' in key store '" + name + "'", e);
            } catch (UnrecoverableKeyException e) {
                throw new IllegalArgumentException(
                        "Unable to recover the key for alias '" + alias + "' in key store '" + name + "'", e);
            }
        }
    }

    private static void verifyTrustStoreAlias(Optional<String> maybeAlias, String name, KeyStore ks) {
        if (maybeAlias.isPresent()) {
            String alias = maybeAlias.get();
            try {
                if (ks.getCertificate(alias) == null) {
                    throw new IllegalStateException(
                            "Alias '" + alias + "' not found in trust store (certificate not found) '" + name + "'");
                }
            } catch (KeyStoreException e) {
                throw new IllegalStateException(
                        "Unable to verify alias '" + alias + "' in trust store '" + name + "'", e);
            }
        }
    }
}

View on GitHub (pinned to e1c734241f)

Solutions

Check the wrapped KeyStoreException cause for the root problem
Regenerate or re-export the trust store in a supported format (PKCS12)
Ensure the required security provider is installed/configured
Verify keystore.type matches the actual file format

Example fix

// before: PEM file referenced as PKCS12
quarkus.tls.my-tls.trust-store.type=PKCS12
quarkus.tls.my-tls.trust-store.p12.path=ca.pem
// after: use the pem trust store config
quarkus.tls.my-tls.trust-store.pem.a.path=ca.pem

Defensive patterns

Strategy: try-catch

Validate before calling

try {
    KeyStore ts = KeyStore.getInstance(type);
    try (InputStream in = new FileInputStream(path)) { ts.load(in, password); }
} catch (Exception e) {
    throw new IllegalStateException("Trust store " + path + " unreadable/incompatible: " + e.getMessage(), e);
}

Try / catch

try {
    // init TLS
} catch (IllegalStateException e) {
    if (e.getMessage() != null && e.getMessage().contains("in trust store") && e.getCause() instanceof KeyStoreException) {
        log.error("Trust store broken: " + e.getCause().getMessage());
    }
    throw e;
}

Prevention

Export trust stores in PKCS12 with standard tooling
Match keystore.type to the real file format
Verify trust store files survive packaging/containers intact (checksum them)
Load the trust store once in a startup test

When it happens

Trigger: ks.getCertificate(alias) throwing KeyStoreException while running verifyTrustStoreAlias — e.g. store not properly loaded, corrupted file, or provider/type mismatch.

Common situations: Trust store built with a provider unavailable at runtime; corrupted or truncated trust store file; mismatched keystore.type setting; JVM security provider changes (e.g. FIPS mode).

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/fc20725be7d861be. Report an issue: GitHub.